feat: add Azure Key Vault provider support with integration tests #90
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the
Comment |
Co-authored-by: macalbert <8038046+macalbert@users.noreply.github.com>
Co-authored-by: macalbert <8038046+macalbert@users.noreply.github.com>
Co-authored-by: macalbert <8038046+macalbert@users.noreply.github.com>
Co-authored-by: macalbert <8038046+macalbert@users.noreply.github.com>
Co-authored-by: macalbert <8038046+macalbert@users.noreply.github.com>
Co-authored-by: macalbert <8038046+macalbert@users.noreply.github.com>
Co-authored-by: macalbert <8038046+macalbert@users.noreply.github.com>
- Enhance README to include Azure Key Vault support alongside AWS. - Create detailed Azure Key Vault setup guide for Envilder.
Co-authored-by: macalbert <8038046+macalbert@users.noreply.github.com>
|
Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…lidation Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR adds Azure Key Vault support alongside the existing AWS SSM provider, enabling multi-cloud secret management in the CLI while preserving AWS as the default and keeping the architecture consistent with the existing ports/adapters pattern.
Changes:
- Introduced
AzureKeyVaultSecretProviderimplementingISecretProvider, including name normalization to satisfy Azure Key Vault constraints and unit + integration tests using Lowkey Vault via Testcontainers. - Extended CLI/domain to accept a
--provideroption (CliOptions.provider) and updatedStartupDI wiring to select either AWS SSM or Azure Key Vault, configured viaAZURE_KEY_VAULT_URL. - Enhanced the tests GitHub workflow with new
workflow_dispatchinputs (map_file,env_file,provider) and updated dependencies/lockfile to include the Azure SDK packages.
Reviewed changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
src/envilder/infrastructure/azure/AzureKeyVaultSecretProvider.ts |
Adds an Azure Key Vault-based ISecretProvider implementation with secret-name normalization and error handling consistent with the AWS SSM provider. |
tests/envilder/infrastructure/azure/AzureKeyVaultSecretProvider.test.ts |
Provides unit tests for normalization/error paths and integration tests against Lowkey Vault to validate real secret get/set behavior. |
src/envilder/domain/CliOptions.ts |
Extends CLI options with an optional provider field to carry the selected cloud provider through the command pipeline. |
src/apps/cli/Startup.ts |
Updates CLI DI setup to choose between AWS SSM and Azure Key Vault based on provider, wiring the appropriate concrete ISecretProvider implementation. |
src/apps/cli/Cli.ts |
Exposes a new --provider CLI flag, adjusts help text for push behavior, and adds a top-level error handler that logs via ILogger or console on failures. |
.github/workflows/tests.yml |
Adds workflow_dispatch inputs for map_file, env_file, and provider to the CI test workflow, though they are not yet used in any steps. |
package.json |
Declares @azure/identity and @azure/keyvault-secrets dependencies required by the Azure provider implementation. |
pnpm-lock.yaml |
Locks Azure SDK and transitive dependencies to concrete versions compatible with the Node 20 test environment. |
e2e/sample/cli-validation.env |
Removes the previous sample content; E2E tests now rely on dynamic generation of this file rather than pre-populated values. |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
| inputs: | ||
| map_file: | ||
| description: 'Path to the JSON file with environment variable mapping' | ||
| required: false | ||
| default: 'param-map.json' | ||
| type: string | ||
| env_file: | ||
| description: 'Path to the .env file to be generated or imported' | ||
| required: false | ||
| default: '.env' | ||
| type: string | ||
| provider: | ||
| description: 'Cloud provider to use' | ||
| required: false | ||
| default: 'aws' | ||
| type: choice | ||
| options: | ||
| - aws | ||
| - azure |
There was a problem hiding this comment.
These newly added workflow_dispatch inputs (map_file, env_file, and provider) are not referenced anywhere in the job (e.g., no inputs.* usage in steps), so changing them when manually dispatching the workflow currently has no effect. To keep the workflow configuration meaningful, either wire these inputs into the steps that should use them (for example via env or with blocks) or remove them until they are needed.
| inputs: | |
| map_file: | |
| description: 'Path to the JSON file with environment variable mapping' | |
| required: false | |
| default: 'param-map.json' | |
| type: string | |
| env_file: | |
| description: 'Path to the .env file to be generated or imported' | |
| required: false | |
| default: '.env' | |
| type: string | |
| provider: | |
| description: 'Cloud provider to use' | |
| required: false | |
| default: 'aws' | |
| type: choice | |
| options: | |
| - aws | |
| - azure |
| // Default to AWS if no provider specified | ||
| const selectedProvider = provider?.toLowerCase() || 'aws'; | ||
|
|
||
| let secretProvider: ISecretProvider; | ||
|
|
||
| if (selectedProvider === 'azure') { | ||
| // Azure Key Vault configuration | ||
| const vaultUrl = process.env.AZURE_KEY_VAULT_URL; | ||
| if (!vaultUrl) { | ||
| throw new Error( | ||
| 'AZURE_KEY_VAULT_URL environment variable is required when using Azure provider', | ||
| ); | ||
| } | ||
| const credential = new DefaultAzureCredential(); | ||
| const client = new SecretClient(vaultUrl, credential); | ||
| secretProvider = new AzureKeyVaultSecretProvider(client); | ||
| } else if (selectedProvider === 'aws') { | ||
| // AWS SSM configuration | ||
| const ssm = awsProfile | ||
| ? new SSM({ credentials: fromIni({ profile: awsProfile }) }) | ||
| : new SSM(); | ||
| secretProvider = new AwsSsmSecretProvider(ssm); | ||
| } else { | ||
| throw new Error( | ||
| `Unsupported provider: ${provider}. Supported providers: aws, azure`, | ||
| ); | ||
| } |
There was a problem hiding this comment.
The new provider selection logic introduces an Azure branch here, but Startup already has tests exercising AWS configuration paths (tests/apps/cli/Startup.test.ts) and there are no tests covering the Azure provider selection, missing AZURE_KEY_VAULT_URL error, or unsupported provider branch. To keep DI configuration behavior well-verified like the AWS path, please add unit tests that (1) configure with provider: 'azure' and assert an AzureKeyVaultSecretProvider is bound, (2) verify an error is thrown when provider is 'azure' and AZURE_KEY_VAULT_URL is unset, and (3) assert an error for an unsupported provider string.
| '--provider <name>', | ||
| 'Cloud provider to use: aws or azure (default: aws)', | ||
| ) | ||
| .option('--push', 'Push local .env file back to cloud provider') |
There was a problem hiding this comment.
The CLI help text above still describes Envilder as managing environment variables "with AWS SSM" and the examples only mention AWS-specific usage, even though this new option exposes both AWS and Azure as providers. To avoid confusing users, please update the description and usage examples to reflect multi-provider support (e.g., mention Azure Key Vault and show a --provider=azure example) in line with this new flag.
Pull Request
What does this PR do?
Adds Azure Key Vault as a cloud provider alongside AWS SSM, maintaining backward compatibility with AWS as the default. This implementation was built from scratch with a clean architecture, has been merged with the latest main branch changes, and includes comprehensive integration tests using Lowkey Vault.
Core Changes:
--providerCLI flag (defaults toaws)AzureKeyVaultSecretProviderimplementingISecretProviderinterface following the same dependency injection pattern as AWSAZURE_KEY_VAULT_URLmap_file,env_file, andprovideroptionsTesting Implementation:
nagyesta/lowkey-vault:2.5.8Docker image for Azure Key Vault emulationGitHub Workflow Enhancements:
Added workflow_dispatch inputs to
.github/workflows/tests.yml:map_file: Path to the JSON file with environment variable mapping (default: param-map.json)env_file: Path to the .env file to be generated or imported (default: .env)provider: Cloud provider choice dropdown (aws/azure, default: aws)Implementation:
Secret paths like
/my-app/db/passwordare automatically normalized tomy-app-db-passwordfor Azure compatibility.Architecture Consistency:
Both providers follow the same dependency injection pattern for consistency:
AwsSsmSecretProvider(ssm: SSM)- Accepts pre-constructed SSM clientAzureKeyVaultSecretProvider(client: SecretClient)- Accepts pre-constructed SecretClientThis provides better testability, more flexibility for credential configuration, and consistent architecture across providers.
Main Branch Integration:
Related issues
Implements requested feature for Azure Key Vault support.
Type of change
Checklist
Notes for reviewer
Startup.configureInfrastructure()SecretClientdirectly (matching AWSSSMpattern) for consistency and better testabilityOriginal prompt
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.